Newly created password content must be checked.

From MAC OSX 10.6 Workstation Security Technical Implementation Guide

Part of OSX00040-Check newly-created password content

Associated with IA controls: IAIA-2, IAIA-1

SV-37177r1_rule Newly created password content must be checked.

Vulnerability discussion

Configure the local system to verify newly created passwords do not contain user's account name or parts of the user's full name exceeding two consecutive characters.

Check content

Open a terminal session and use the following command to view the setting for "password cannot be name". sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep passwordCannotBeName If the value of "passwordCannotBeName" is not equal to "1", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep passwordCannotBeName If the value of "passwordCannotBeName" is not equal to "1", this is a finding.

Fix text

Open a terminal session and use the following command to set the value for "password cannot be name". sudo pwpolicy -n -setglobalpolicy "passwordCannotBeName=1" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "passwordCannotBeName=1"

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.